Comcast Cybersecurity: Principal Security Architect

Make your mark at Comcast -- a Fortune 30 global media and technology company. From the connectivity and platforms we provide, to the content and experiences we create, we reach hundreds of millions of customers, viewers, and guests worldwide. Become part of our award-winning technology team that turns big ideas into cutting-edge products, platforms, and solutions that our customers love. We create space to innovate, and we recognize, reward, and invest in your ideas, while ensuring you can proudly bring your authentic self to the workplace. Join us. You’ll do the best work of your career right here at Comcast. (In most cases, Comcast prefers to have employees on-site collaborating unless the team has been designated as virtual due to the nature of their work. If a position is listed with both office locations and virtual offerings, Comcast may be willing to consider candidates who live greater than 100 miles from the office for the remote option.)

Job Summary

The ideal candidate will be familiar with Threat Model assessment techniques (Stride, Dread) as well as disciplines such as Architecture and the Software Development Lifecycle (SDLC). Familiarity with Red Team activities such as penetration testing, vulnerability scanning, vulnerability remediation and cloud environments.

Job Description

Responsibilities 

• Executes on Threat Modeling Assessment program. 

• Perform threat modeling to identify use cases, threat agents, attack vectors and patterns, design patterns, and compensating controls needed to mitigate risk. 

• Acts as a Cyber Resilience champion of the Threat Modeling Assessment program. 

• Participate in SDLC process and architecture approval routines related to cyber threat modeling. 

• Creates and delivers reports that capture identified risks, controls, assets, trust zones and enhancement requirements. 

• Partners with stakeholders on Threat Modeling Assessment Issues to create action plans identified during fieldwork. 

• Ability to concurrently perform multiple Threat Modeling engagements. 

• Determines alignment of Cyber Resilience controls in practice with those from authoritative sources such as OWASP, NIST SP 800-53 and ISO 27002 to provide holistic insight into current capabilities and risk themes as well as best practices. 

• Understands the impact of cyber risks as it relates to both firm and industry wide impacts to technical and security dependencies and single points of failure to enhance mitigation activities. 

• Educates and provides subject matter expertise to support the business on cyber hygiene activities and enhancements based on business related impacts. 

Qualifications and Skills 

• Certified Information Systems Security Professional (CISSP)

• Deep understanding of software architecture and security architectural elements as they relate to risks and controls. Ability to accurately capture and enhance architectural diagrams. 

• 10+ years of direct work experience with elements of security architecture and cyber threats. 

• Working knowledge of business and cyber risk management process and controls, industry practices, and frameworks (e.g., NIST 800-53, ISO 27000 family). 

• Broad knowledge of cloud technologies (Related certifications a plus). 

• Detail oriented, with proven ability to question the status quo and apply resilience activities to enhance capabilities, as appropriate. 

• Strong organizational skills, with proven ability to successfully manage multiple, concurrent priorities and team members as the program is built out. 

• Ability to communicate and work effectively in a matrixed environment and across various organizational levels, where flexibility, collaboratio